Attestor Air-Gap Guide (DOCS-ATTEST-75-001)

Last updated: 2025-11-25

Goal

Run attestation verification entirely offline while keeping determinism and tenant safety intact.

Trust bundle: DSSE signing keys + certificate chains packaged under out/offline/attestor/trust-bundle/ (hash manifest included).
Transparency checkpoints (optional): Rekor or equivalent checkpoints mirrored to out/offline/attestor/transparency/.
Authority scopes: attest:verify and tenant scoping (X-StellaOps-TenantId) are still required even in sealed mode.
No external calls: Outbound network must be disabled; attestor uses only the provided bundles.

Set the following environment flags on WebService/Worker:

Mount the bundle directories read-only; keep hashes alongside the payloads for audit.

Client submits a DSSE envelope to /api/v1/attestations/verify with tenant header.
Service loads keys from the offline trust bundle; issuer lookup is strictly local.
If transparency data is present, the server verifies inclusion against the mirrored checkpoint; otherwise it records transparency=skipped in the rationale.
Result is returned with deterministic fields: subject, statementDigest, verified=true|false, transparency=passed|skipped|failed, rationale[].

[ ] Refresh trust bundle hashes before each deploy; compare against signed manifest.
[ ] Rotate keys by replacing the bundle atomically; restart workers to pick up changes.
[ ] Record verification results in the delivery ledger for replay/audit.